CVE-2026-34777
Permission Origin Spoofing in Electron iframe Permission Handling
Publication date: 2026-04-04
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | to 38.8.6 (exc) |
| electronjs | electron | From 39.0.0 (inc) to 39.8.1 (exc) |
| electronjs | electron | From 40.0.0 (inc) to 40.8.1 (exc) |
| electronjs | electron | 41.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update Electron to a patched version: 38.8.6, 39.8.1, 40.8.1, or 41.0.0 or later.
If updating is not immediately possible, modify the application's permission handling code to inspect details.requestingUrl instead of the origin parameter or webContents.getURL() within the session.setPermissionRequestHandler() implementation. This ensures permissions are granted based on the correct requesting iframe's origin.
Can you explain this vulnerability to me?
CVE-2026-34777 is a vulnerability in the Electron framework affecting versions prior to 38.8.6, 39.8.1, 40.8.1, and 41.0.0. When an iframe requests permissions such as fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, Electron incorrectly passes the top-level page's origin to the session.setPermissionRequestHandler() instead of the iframe's own origin.
This misattribution can cause applications that grant permissions based on the origin parameter or webContents.getURL() to inadvertently grant permissions to embedded third-party iframe content, potentially allowing unauthorized access. The correct requesting URL is still available via details.requestingUrl, and applications that use this property for permission decisions are not affected.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized permission grants to embedded third-party iframe content within an Electron application. If an app grants permissions based on the top-level origin rather than the actual requesting iframe's origin, malicious or untrusted iframe content could gain access to sensitive capabilities such as fullscreen, pointer lock, keyboard lock, opening external links, or media permissions.
Such unauthorized access could compromise the confidentiality and integrity of the application environment, potentially allowing attackers to perform actions or access resources they should not have permission for.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from Electron applications incorrectly passing the top-level page's origin instead of the iframe's origin when requesting certain permissions. Detection involves reviewing the application's code, specifically the implementation of session.setPermissionRequestHandler(), to check if permissions are granted based on the origin parameter or webContents.getURL() rather than details.requestingUrl.
There are no specific network or system commands provided to detect this vulnerability automatically. Instead, developers should audit their permission handling code to ensure it uses details.requestingUrl for permission decisions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can lead to applications inadvertently granting permissions to embedded third-party iframe content due to incorrect origin attribution. Such unauthorized access to permissions may result in exposure or misuse of sensitive data.
Improper permission handling and potential unauthorized access could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict control over access to personal and sensitive information.
Applications that do not correctly verify the requesting origin may risk violating these regulations by allowing third-party content to access permissions that could lead to data leakage or unauthorized actions.
However, applications that use the correct requesting URL (details.requestingUrl) for permission decisions are not affected by this vulnerability and thus maintain compliance.